/usr/bin/virtiofsd

Launch a virtiofsd backend.

Usage: virtiofsd --shared-dir <SHARED_DIR> --socket-path <SOCKET_PATH> [OPTIONS]

Options:
      --shared-dir <SHARED_DIR>
          Shared directory path

      --tag <TAG>
          The tag that the virtio device advertises

          Setting this option will enable advertising of VHOST_USER_PROTOCOL_F_CONFIG. However, the vhost-user frontend of your hypervisor may not negotiate this feature and (or) ignore this value. Notably, QEMU currently (as of 8.1) ignores the CONFIG feature. QEMU versions from 7.1 to 8.0 will crash while attempting to log a warning about not supporting the feature.

      --socket <SOCKET>
          vhost-user socket path [deprecated]

      --socket-path <SOCKET_PATH>
          vhost-user socket path

      --socket-group <SOCKET_GROUP>
          Name of group for the vhost-user socket

      --fd <FD>
          File descriptor for the listening (not yet connected) socket

      --thread-pool-size <THREAD_POOL_SIZE>
          Maximum thread pool size. A value of "0" disables the pool

          [default: 0]

      --xattr
          Enable support for extended attributes

      --posix-acl
          Enable support for posix ACLs (implies --xattr)

      --xattrmap <XATTRMAP>
          Add custom rules for translating extended attributes between host and guest (e.g. :map::user.virtiofs.:)

      --sandbox <SANDBOX>
          Sandbox mechanism to isolate the daemon process (namespace, chroot, none)

          [default: namespace]

      --readonly
          Prevent the guest from making modifications to the filesystem

      --seccomp <SECCOMP>
          Action to take when seccomp finds a not allowed syscall (none, kill, log, trap)

          [default: kill]

      --announce-submounts
          Tell the guest which directories are mount points [default]

      --no-announce-submounts
          Do not tell the guest which directories are mount points

      --inode-file-handles=<INODE_FILE_HANDLES>
          When to use file handles to reference inodes instead of O_PATH file descriptors (never, prefer, mandatory)

          - never: Never use file handles, always use O_PATH file descriptors.

          - prefer: Attempt to generate file handles, but fall back to O_PATH file descriptors where the underlying filesystem does not support file handles.  Useful when there are various different filesystems under the shared directory and some of them do not support file handles.  ("fallback" is a deprecated alias for "prefer".)

          - mandatory: Always use file handles, never fall back to O_PATH file descriptors.

          Using file handles reduces the number of file descriptors virtiofsd keeps open, which is not only helpful with resources, but may also be important in cases where virtiofsd should only have file descriptors open for files that are open in the guest, e.g. to get around bad interactions with NFS's silly renaming.

          [default: prefer]

      --cache <CACHE>
          The caching policy the file system should use (auto, always, never, metadata)

          [default: auto]

      --allow-mmap
          When used with --cache={metadata, never} will allow shared files to be mmap'd. Regardless of the selected cache policy, this option should only be enabled when the file system has exclusive access to the directory

      --no-readdirplus
          Disable support for READDIRPLUS operations

      --writeback
          Enable writeback cache

      --allow-direct-io
          Honor the O_DIRECT flag passed down by guest applications

      --print-capabilities
          Print vhost-user.json backend program capabilities and exit

      --modcaps <MODCAPS>
          Modify the list of capabilities, e.g., --modcaps=+sys_admin:-chown

      --log-level <LOG_LEVEL>
          Log level (error, warn, info, debug, trace, off)

          [default: info]

      --syslog
          Log to syslog [default: stderr]

      --rlimit-nofile <RLIMIT_NOFILE>
          Set maximum number of file descriptors (0 leaves rlimit unchanged) [default: min(1000000, '/proc/sys/fs/nr_open')]

  -o <COMPAT_OPTIONS>
          Options in a format compatible with the legacy implementation [deprecated]

  -d
          Set log level to "debug" [deprecated]

      --no-killpriv-v2
          Disable KILLPRIV V2 support [default]

      --killpriv-v2
          Enable KILLPRIV V2 support

  -f
          Compatibility option that has no effect [deprecated]

      --security-label
          Enable security label support (implies --xattr). Expects SELinux xattr on file creation from client and stores it in the newly created file

      --uid-map <UID_MAP>
          Map a range of UIDs from the host into the namespace, given as :namespace_uid:host_uid:count:

          As opposed to '--translate-uid', this mapping is not done by virtiofsd, but by the user namespace into which virtiofsd is placed via '--sandbox=namespace'.

          For example, :0:100000:65536: will map the 65536 host UIDs [100000, 165535] into the namespace as [0, 65535].

          Provide this argument multiple times to map multiple UID ranges.

      --gid-map <GID_MAP>
          Map a range of GIDs from the host into the namespace, given as :namespace_gid:host_gid:count:

          As opposed to '--translate-gid', this mapping is not done by virtiofsd, but by the user namespace into which virtiofsd is placed via '--sandbox=namespace'.

          For example, :0:100000:65536: will map the 65536 host GIDs [100000, 165535] into the namespace as [0, 65535].

          Provide this argument multiple times to map multiple GID ranges.

      --translate-uid <TRANSLATE_UID>
          Describe how to translate UIDs between guest and host, given as '<type>:<source base>:<target base>:<count>'.

          As opposed to '--uid-map', this mapping is done internally by virtiofsd, and does not require using a user namespace.

          'type' describes how to do the mapping, and in which direction:

          - 'guest': 1:1 map a range of guest UIDs to host UIDs

          - 'host': 1:1 map a range of host UIDs to guest UIDs

          - 'squash-guest': n:1 map a range of guest UIDs all to a single host UID

          - 'squash-host': n:1 map a range of host UIDs all to a single guest UID

          - 'forbid-guest': Forbid guest UIDs in the given range: Return an error to the guest whenever it tries to create a file with such a UID or make a file have such a UID

          - 'map': bidirectionally 1:1 map between a range of guest UIDs and host UIDs; the order is: 'map:<guest base>:<host base>:<count>'

          Provide this argument multiple times to map multiple UID ranges.

          Cannot be used together with --posix-acl; translating UIDs (or GIDs) in virtiofsd would break posix ACLs.

      --translate-gid <TRANSLATE_GID>
          Same as '--translate-uid', but for GIDs

      --preserve-noatime
          Preserve O_NOATIME behavior, otherwise automatically clean up O_NOATIME flag to prevent potential permission errors when running in unprivileged mode (e.g., when accessing files without having ownership/capability to use O_NOATIME)

      --migration-mode <MIGRATION_MODE>
          Defines how to perform migration, i.e. how to represent the internal state to the destination, and how to obtain that representation.

          - find-paths: Obtain paths for all inodes indexed and opened by the guest, and transfer those paths to the destination.  To get those paths, we try to read the symbolic links in /proc/self/fd first; if that does not work, we will fall back to iterating through the shared directory (exhaustive search), enumerating all paths within.

          - file-handles: Pass file handles.  For this to work, source and destination instance must operate on exactly the same shared directory on the same filesystem (which may be a network filesystem, mounted on different hosts).  The destination instance must have the capability to open file handles, i.e. CAP_DAC_READ_SEARCH -- generally, this requires running virtiofsd as root and use `--modcaps=+dac_read_search`.

          This parameter is ignored on the destination side.

          [default: find-paths]

      --migration-on-error <MIGRATION_ON_ERROR>
          Controls how to respond to errors during migration.

          If any inode turns out not to be migrateable (either the source cannot serialize it, or the destination cannot opened the serialized representation), the destination can react in different ways:

          - abort: Whenever any error occurs, return a hard error to the vhost-user front-end (e.g. QEMU), aborting migration.

          - guest-error: Let migration finish, but the guest will be unable to access any of the affected inodes, receiving only errors.

          This parameter is ignored on the source side.

          [default: abort]

      --migration-verify-handles
          Only for find-paths migration mode: Ensure that the migration destination opens the very same inodes as the source (only works if source and destination use the same shared directory on the same filesystem).

          This option makes the source attach the respective file handle to each inode transferred during migration.  Once the destination has (re-)opened the inode, it will generate the file handle on its end, and compare, ensuring that it has opened the very same inode.

          (File handles are per-filesystem unique identifiers for inodes that, besides the inode ID, also include a generation ID to protect against inode ID reuse.)

          Using this option protects against external parties renaming or replacing inodes while migration is ongoing, which, without this option, can lead to data loss or corruption, so it should always be used when other processes besides virtiofsd have write access to the shared directory.  However, again, it only works if both source and destination use the same shared directory.

          This parameter is ignored on the destination side.

      --migration-confirm-paths
          Only for find-paths migration mode: Double-check the identity of inodes right before switching over to the destination, potentially making migration more resilient when third parties have write access to the shared directory.

          When representing migrated inodes using their paths relative to the shared directory, double-check during switch-over to the destination that each path still matches the respective inode, and on mismatch, try to correct it via the respective symlink in /proc/self/fd.

          Because this option requires accessing each inode indexed or opened by the guest, it can prolong the switch-over phase of migration (when both source and destination are paused) for an indeterminate amount of time.

          This parameter is ignored on the destination side.

  -h, --help
          Print help (see a summary with '-h')

  -V, --version
          Print version